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METHOD AND APPARATUS FOR REMOVING HEAT FROM A 
PROTECTION REGION WITHIN A TAMPER RESPONSIVE PACKAGE 

BACKGROUND OF THE INVENTION 

[0001] The invention relates in general to tamper responsive packages and more 
specifically to a method and apparatus for removing heat from a tamper responsive 
package. 

[0002] Tamper responsive packages are used to physically protect devices and 
stored information by detecting tampering with the package. Tamper responsive 
packages are often formed by surrounding the electronic circuitry or device to be 
protected in a security envelope of a material that allows detection of any 
discontinuity, breaking or other mutilation of the material. A conventional tamper 
responsive package may include a thin material, often referred to as a tamper 
detection mesh, having a pattem of electromagnetic paths enclosing the protected 
circuitry. Tampering with the package results in damaging the material such that the 
change in the structure of the material is revealed in a change in the electrical 
characteristics of the material. These types of security envelopes typically require the 
entire protected circuit or device to be enclosed in a material having a high thermal 
resistance. In addition, conventional techniques often involve fiirther covering the 
security envelope in substances having a relative high thermal resistance. Heat 
generated by the protected circuitry inside a high security envelope can not easily 
escape through the envelope, which can result in exposure of the circuitry to 
extremely high temperatures within the envelope. Such high temperatures often lead 
to poor circuit performance and can result in catastrophic failures of the circuit. 

[0003] Therefore, there is need for an apparatus and method for removing heat 
form a tamper responsive package. 
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SUMMARY OF THE INVENTION 
[0004] In an exemplary embodiment, a thermal conductor provides a thermal path 
from a protected region within a security envelope to an exterior region of the security 
envelope. The security envelope is formed around a housing that contains a protected 
device using a security material and allows the detection of physical tampering of the 
housing or the protected device. The thermal conductor conducts heat through a fold 
formed by overlapping sections of security material forming the security envelope. 

BRIEF DESCRIPTION OF THE DRAWINGS 
[0005] Figure 1 is a block diagram of a tamper responsive system including a 
protected device and a tamper responsive package in accordance with the exemplary 
embodiment of the invention. 

[0006] Figure 2 is a diagrammatic representation of a perspective view of the 
tamper responsive system including a protected device and a tamper responsive 
package in accordance with the exemplary embodiment of the invention. 

[0007] Figure 3 is a diagrammatic representation of a side view of the tamper 
responsive system including a protected device and a tamper responsive package in 
accordance with the exemplary embodiment of the invention. 

[0008] Figure 4 is a flow chart of method of removing heat from a protected region 
within a security envelope of a tamper responsive package in accordance with the 
exemplary embodiment of the invention. 

[0009] Figure 5 is a flow chart of a method of manufacturing a tamper responsive 
system in accordance with the exemplary embodiment of the invention. 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
[0010] Figure 1 is a block diagram of a tamper responsive system 100 in 
accordance with the exemplary embodiment of the invention. The tamper responsive 
system 100 includes a protected device within a tamper restive package. A security 
envelope 102 is an envelope that surroxmds a protected region 104 and allows the 
detection of physical tampering with anything contained within the protected region 
104. As explained below, a suitable method of forming the security envelope 102 
includes shaping a thin security material, such a tamper detection mesh, around the 
desired protected region 104. Li the exemplary embodiment, the tamper detection 
mesh is shaped around a housing 106 that contains a protected device 108. A thin, flat 
sheet of security material is wrapped around the housing 106 such that two or more 
sections of material overlap to form folds 110. 

[0011] A thermal conductor 1 12 provides a thermal path from the protected region 
104 to an exterior region 116 of the security envelope 102. In the exemplary 
embodiment, the thermal conductor 1 12 thermally contacts the protected device 108 
through a thermal connection having a minimal thermal resistance. A suitable 
technique of forming a thermal connection between the thermal conductor 112 and 
the protected device 108 includes directly connecting the thermal conductor 1 12 to 
the protected device 108. A thermal connection between the thermal conductor 112 
and the protected device 108 can be formed using a conductive material having a low 
thermal resistance such as thermally conductive grease. The thermal connection 
between the thermal conductor 1 12 and the protected device 108 may be formed using 
the housing 106. For example, an adequate thermal connection between the protected 
device 108 and the housing 106 allows heat to flow from the protected to the housing 
106. The thermal conductor 112 can be thermally connected to the housing 106 to 
provide a thermal path from the housing 108 within the protected region 104 to the 
exterior region 116 and thereby providing a thermal path from the protected device 
108 to the exterior region 116. 
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[0012] The heat generated within the protected region 104 is channeled through an 
opening in the housing 106 and the fold 1 10 to the exterior of the security envelope 
102. In the exemplary embodiment, the heat is transferred to a heat sink 118 through 
conduction and dissipated to the air of the exterior 1 16 of the security envelope 102 
through convection. The heat sink 1 18 is drawn using a box having dashed Hues to 
illustrate that the heat sink 118 may not be required in certain instances. Other 
suitable techniques of dissipating the heat include dissipating the heat directly from 
the thermal conductor 1 12 to the air through convection. Further, the thermal 
conductor 112 may be shaped to include heat fins to improve heat dissipation to the 
air. In some implementations it may be desirable to use cooling fluids other than air. 
Other gases may be used for convection or liquid cooling may be used in some 
instances. 

[0013] Figure 2 and Figure 3 are diagranmiatic representations of a perspective 
view and a side view of the tamper responsive system 100 in accordance with the 
exemplary embodiment of the invention. Figure 2 and Figure 3 are provided for 
illustrative purposes and are not necessarily drawn to scale. In the exemplary 
embodiment, the tamper responsive system 100 includes a protected device 108 
within a tamper responsive package formed by the security envelope 102, housing 106 
and the thermal conductor. Those skilled in the art will recognize the various 
additional elements that may be used in a tamper restive package. For example, wires 
or ribbon cables may be attached to the protected circuit and other circuitry or devices 
within the tamper responsive package. The protected device is located in a protected 
region 104 within the security envelope 102 formed from a security material. In the 
exemplary embodiment, the security envelope 102 is wrapped around the housing 106 
which includes the protected device 108. 

[0014] In Figure 2, the exemplary tamper responsive system 100 is drawn with a 
cut away section to illustrate the inside of the housing 106. The cross hatched area 
illustrates the exposed housing 106 underneath the security envelope 102. In the 
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exemplary embodiment, therefore, the entire housing 106 is covered by the security 
envelope and no portion of the housing 106 is visible from the exterior region 116. 

[0015] The security envelope 102 may be formed in a variety of ways using one or 
more sheets of security material. In order to completely cover the housing 106 with a 
planer sheet of security material, the security envelope 102 is formed to include one 
or more folds 110 where at least one section of security material overlaps a second 
section of security material. One simple analogy of the forming of the security 
envelope 102 around the housing 106 includes the wrapping of box with gift 
wrapping paper. 

[0016] The protected device 108 is positioned within the housing 106 and is 
secured in accordance with known techniques, hi the exemplary embodiment, the 
protected device 108 is soldered or otherwise attached to a circuit board (not shown). 
The protected device 108 may be one or more devices and may include any 
combination of integrated circuits (ICs), circuits, components, memory chips, 
encryption devices, or any other type of electronic device requiring physical security. 
As suitable example of a protected device 108 includes a cryptographic processor, 

[0017] The tamper responsive package provides physical security by detecting 
physical tampering with the security envelope 102, the housing 106 or the protected 
device 108. Li accordance with known techniques, tampering is detected by observing 
a change in electrical characteristics of the security envelope 102. For example, if an 
unauthorized party attempts to drill through the housing 106 to access the protected 
device 108, the disruption of the tamper detection mesh used to form the security 
envelope 102 is detected by a sensing circuit. A sending circuit (not shown) detects 
that a tampering has occurred if the tamper detection mesh is cut, broken, drilled, 
punctured, mutilated or altered in any way. The security material of the security 
envelope 102 is adhered to the both the housing 106 and to the thermal conductor 1 12 
in the exemplary embodiment. Any attempt to separate the security material from the 
either the housing 106 or the thermal conductor 112 will result in detection by the 
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sensing circuit. The detection by the sensing circuit may invoke a variety of counter 
measures such as erasing the contents of the protected device 108, destroying the 
protected device 108 or otherwise disabhng the protected device 108 to secure the 
information to be protected, 

[0018] As explained above, the thermal conductor 1 12 is thermally connected to 
the protected device 108. The protected device 108 may have housing or cover 
formed from any one of several materials such as metal or plastic. Those skilled in the 
art will recognize the various techniques that can be used to form the thermal 
connection. The thermal conductor 1 12, for example, may be soldered to a casing or 
housing of the protected device 108. Other techniques include using thermal 
conductive grease or physically securing the thermal conductor 1 12 to the protected 
device 108 with fasteners. 

[0019] Li the exemplary embodiment, the thermal conductor 1 12 is a section of 
copper tape that forms a thermal connection with the protected device 108 and is 
threaded through the fold 110. The thermal conductor 1 12 may be formed using 
various thermally conductive materials and may have a variety of shapes and 
dimensions suitable for channeling heat from the protected device 108 through the 
fold 110, 

[0020] In the exemplary embodiment, the thermal conductor 1 12 is guided through 
the housing 106. As shown in Figure 3, an opening 1 14 in the housing 106 provides a 
thermal path for the thermal conductor 1 12. A suitable opening 114 may be formed by 
drilling a hole or cutting a slit having dimensions adequate for the thermal conductor 
to pass through without contacting the housing 106. 

[0021] Therefore, in the exemplary embodiment, the thermal conductor 1 12 forms 
a thermal pathway from the protected region 104 to the exterior region 1 16 by 
channeling heat generated by the protected device through a fold 1 10 in the security 
envelope 102 formed around the protected region 104. Heat can be removed from the 
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protected device 108 without disturbing the integrity of the security envelope 102. 
The performance of the protected device is improved while reducing the possibility of 
a catastrophic failure. 

[0022] Those skilled in the art will recognize the other embodiment and 
modifications based on the teachings herein. For example, the thermal conductor may 
provide a thermally conductive path from the protected region 104 to the exterior 
region 116 without directly contacting the protected device 108. Such an 
implementation may be desired where the housing is thermally conductive and the 
protected device is thermally connected to the housing 106. Heat generated by the 
protected device is absorbed by the housing and is dissipated from the protected 
region to the exterior region 116 through the thermal conductor 1 12. 

[0023] Figure 4 is a flow chart of a method of removing heat from a protected 
region 104 within a tamper responsive package in accordance with the exemplary 
embodiment of the invention. At step 402, heat is channeled from the protected 
device 108 through a thermal connection between the protected device and the 
thermal conductor 1 12. In the exemplary embodiment, conduction is used to transfer 
the heat directly from the protected device to the thermal conductor 1 12. Substances 
such as thermally conductive grease can be used to transfer heat the protected device 
108 to the thermal conductor 112. 

[0024] At step 404, the heat is channeled from the protected device 108 through a 
fold in the security envelope 102 to the exterior region 116 of the security envelope 
102. The thermal conductor 112 conducts the heat from the protected device 108 and 
between the overlapping sections of security material forming the fold 1 10. Li the 
exemplary embodiment, a section of copper tape (1 12) threaded through an opening 
1 14 within the housing 106 and between the sections of tamper detective mesh (102) 
provides a thermal path to the exterior region 1 16 for the heat. In some instances, 
multiple thermal conductors 112 may be used transfer heat to the exterior region 116. 
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[0025] At step 406, the heat is dissipated to the exterior region. The heat may be 
dissipated though natural convention or forced convention to the air within the 
exterior region 116. Further, the heat may be dissipated to a heat sink within the 
exterior region 116. 

[0026] Figure 5 is a flow chart of a method of manufacturing a tamper responsive 
system 100 in accordance with the exemplary embodiment of the invention. At step 
502, the protected device 108 is mounted on a circuit board. Li the exemplary 
embodiment, the protected device 108 and other components are soldered or 
otherwise secured to the circuit board. 

[0027] At step 504, the thermal conductor 1 12 is attached to the protected device 
108. In the exemplary embodiment, the thermal conductor 112 is a section of copper 
tape having a pre-appUed adhesive allowing the tape to be attached to the protected 
device by joining the adhesive side of the copper tape to the protected device 108. 
Other methods of attaching the thermal conductor include soldering, gluing, an 
fastening the thermal conductor to the protected device 108. Further, a thermally 
conductive grease can be applied between the thermal conductor 112 and the 
protected device 108 to improve heat transfer from the protected device 108 to the 
thermal conductor 1 12, Li the exemplary embodiment, ribbon cable providing is 
connected to the ports of the protected device 108 and other components. 

[0028] At step 506, the thermal conductor 1 12 is guided through an opening 1 14 in 
a housing 106. hi the exemplary embodiment, the ribbon cable is guided through 
either the opening 1 14 or through another opening in the housing 106. 

[0029] At step 508, the protected device 108 is enclosed by the housing 106. In the 
exemplary embodiment, the housing 106 is a metal enclosure often referred to as a 
"metal can" that is secured to the circuit board. 

[0030] At step 510, the housing 106 is enclosed with the security material to form 
a security envelope 102 having a fold 110 such that the thermal conductor 1 12 is 
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positioned between the sections of security material forming the fold 110. One or 
more planar sheets of security material such as tamper detection mesh are wrapped 
around the housing 106. The fold 1 10 is positioned to allow the thermal conductor 
112 and the ribbon cable to pass through the security envelope 102 to the exterior 
region 116. 

[0031] At step 512, the security envelope 102 is encased in a potting material. The 
potting material provides a hard shell or enclosure that provides an additional 
deterrent to tampering as well as providing a mechanism for firmly securing the 
security envelope 102 to the housing 106. An epoxy can be used as a potting 
material, 

[0032] Li the exemplary embodiment, the various steps described in reference to 
Figure 5 are performed ui the order presented above. In some instances, the steps may 
be performed in other sequences. For example, the thermal conductor may be guided 
through the opening in the housing after the protected device 108 is enclosed by the 
housing 106. 

[0033] Clearly, other embodiments and modifications of this invention will occur 
readily to those of ordinary skill in the art in view of these teachings. Therefore, this 
invention is to be limited only by following claims, which include all such 
embodiments and modifications when viewed in conjunction with the above 
specification and accompanying drawings. 

WHAT IS CLAIMED IS: 
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